hi all,

how to block telnet port 25? using iptables? it seem to be not working at all.

iptables -A INPUT -p tcp --dport 23 -j DROP

all i can do is blocking ppl from telneting my machine, but, i cant stop ppl from telnetting port 25. FYI, i am using postfix as my MTA.

actually, i can something like that if i can able to telnet port 25.

telnet mailserver.com 25
helo mailserver.com
mail from:<someone@mailserver.com>
rcpt to:<someone@mailserver.com>
data

test

.
data is been sent out with the mail with subject undisclosed recipient.

please advise. thanks

If you are still wanting to receive incoming mail, you can't stop someone from telneting to the SMTP port. As long as the proper SMTP commands are sent, here is no way for the mail daemon to differentiate between a remote mail client or telnet.

If you want to block incoming mail or at least limit the IP addresses that can send you mail, then that is a different situation.

when you use telnet on a port such as 25 it is not a REAL telnet connection. You are connected to the SMTP server and using the telnet client you can issue commands directly to your server.

If you stopped the SMTP server you wont be able to telnet to it anymore.

p.s. you can do this to many services such as HTTP also and can be used to check connections and service availability

what if someone telnet port 25 and make a virus attachment through the mail? could it be possible make an attachment through telnetting?

there is anothe thing... then, i can simply impersonate a particular to sending email on behalf of him???? is that true?

then, what is the protection ?

Yes. As already stated, when you "telnet" to port 25, you are acting as another SMTP server attempting to deliver mail to your server. Yes. Have you never recieved spam before? Protection against what? Imperonating someone else's email? There are no good solutions really. Some people will say that SPF provides good protection, but it doesn't. Most SMTP servers these days provide you with methods to reject mail to unknown users. But spam is simply a fact of life if you are going to run an SMTP server on today's internet.

do u think, authentication before smtp will solve the problem?

it will limit the risk to a degree because people wont be able to send anything using your SMTP server without the auth user/pass but people will still be able to telnet in and attempt, no way of stopping that. Do you recieve emails on this box? or just sending? If you are just sending you may be able to restrict the access to the SMTP server to IP's you know.